CVE-2015-1782

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3182Third Party Advisory
http://www.libssh2.org/adv_20150311.htmlVendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:148Broken Link
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73061
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3182Third Party Advisory
http://www.libssh2.org/adv_20150311.htmlVendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:148Broken Link
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73061

Timeline

Published: Mar 13, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-17837.5The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers CVE-2015-17848.8In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we CVE-2015-17856.5In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we CVE-2015-17868.8Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token iden CVE-2015-17872.6The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-He CVE-2015-17884.3The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0 CVE-2015-17897.5The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1 CVE-2015-17905.0The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 befor CVE-2015-17916.8Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0 CVE-2015-17925.0The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.CVE-2015-17936.5The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic CVE-2015-17945.0The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segme